SleepyStill07
2007-01-01, 14:03
Right I had the Zlob trojan on my desktop two days ago. I did not know this at the time. I just kept seeing pop ups saying I had a trojan and then being taken to a weird site selling anti virus. I did not trust it. So I went to Mcafee and installed their security centre. Scans were all clear. It seemed to go away. Then next tiome I log on ...computer running very slow. Ifigure its Mcafee...as it takes loads of memory up. So I go and start uninstalling bits...like thevirus protwection. The pop ups come back. Internet explorer starts not to work. I panic. I start a sysytem restore. I log back on. ****....now I cannot even acess the control panel....
This message comes up:
C:Windows/system32\rundill32.e...
Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.
I went into safe mode, clicked off system restore, run Spyhunter and Spybot search and destroy, removed the trojan,....but as I cannot turn system restore back on in safe mode.....
spybotsandra
2007-01-01, 21:11
Hello,
At first: SpyHunter is a not recommendable tool.
Spybot - Search & Destroy detects this software as malware.
There are anti-spyware tools like 1stAntivirus, AdsAlert, ADS-Remover, AdwareAlert, ADWAREBazooka, Adware-Patrol, AdWare Pro, AdwarePunisher, Adware Remover, AdwareSheriff, AdwareSpy, AdwareX Eliminator, AgentSpyware, Alfacleaner, Antispywaresoldier, Antivirus Gold, AntiVirusPro, BPS Spyware Remover, DiaRemover, Doctor-Adware-Pro, Easy-Spyware-Killer, ErrorGuard, ETD-Security-Scanner, EyeSpyNow, Goodbye-Spy, KillSpy, NoAdware, PC-Health-Plan, Pestbot, PSGuard, PurityScan, Registry Cleaner, Repair Registry Pro, ScanSpyware, Spionfrei, SpyAxe, SpyBlocs, SpyCleaner, Spycontra, Spydeface, SpyDestroy-Pro, SpyFalcon, SpyGuard, SpyHeal, Spyhunter, SpySherrif, SpySpotter, SpywareBomber, SpywareBot, SpywareCleaner, SpywareNO!, SpywareSoftStop, SpywareStormer, SpywareStrike, SpywareQuake, SpyQuake, Trek Blue Error Nuker, Trojan-Guarder, TrueSword, Virusblast, WareOut, WinAntivirusPro2006, WinFixer, WinHound, WorldAntispy, X-Con-Spyware-Destroyer, X-Spyware, XSRemover, YourSoft-AntiVS or YourSoft-AntiVT which have a very dubious or bad character. They state to be an anti-spyware tool but employ questionable advertising methods: In the form of a PopUp they offer a scan of your system. They refer you to an infection of viruses and spyware on your system which is actually not true, because the listed items are not really on your pc. After downloading the software you can only scan for the threats. If the threats (pseudo-infections) are detected you have to register first and pay (up to $30) in order to remove them. Some of these dubious anti-spyware tools do also create a toolbar in IE and create recurring PopUps.
Screenshots are availible at: http://board.protecus.de/showtopic.php?threadid=15694
More dubious anti-spyware tools you will find here:
http://spywarewarrior.com/rogue_anti-spyware.htm
Further please download the latest detection update (2006/12/29):
http://www.safer-networking.org/en/download/index.html
This should fix it with new detection rules for Zlob.
Or choose the direct installation file:
http://www.safer-networking.org/upda...d_includes.exe
If this doesn´t solve the problem please send us your *complete* Spybot bug report: Run Spybot-S&D, let it scan, try to fix the problems (!) and then go to "Tools --> View Report". Tick on all of the 10 checkboxes (leave "Do not report disabled or known legitimate items" unchecked) you can find there and click on "View Report". Now choose "Export" and save the file to your desktop. Please attach this file to your email and send it again to detections(at)spybot.info.
Best regards
Sandra
Team Spybot